Junglewise Threat Intelligence

CVE-2026-89719: Linux kernel zram out-of-bounds access in read_block_state()

CVE-2026-89719 · Severity: info · Published 2026-09-11

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

Linux kernel's zram (compressed RAM) block device driver contains a race condition in the read_block_state() function that can cause out-of-bounds memory access. If a zram device is reconfigured with a smaller size while this function is executing, the function may access memory locations beyond the newly allocated table, potentially causing a kernel crash or system instability.

Technical details

The vulnerability is a race condition (CWE-362) in the zram_drv.c read_block_state() function. The function initially reads the zram device's disksize without holding the dev_lock, calculates nr_pages from this value, and then acquires the lock. If the device is reset and reinitialized with a smaller disksize between the initial read and lock acquisition, the nr_pages variable becomes stale and describes the old table. The subsequent loop then calls slot_lock() using this stale index, potentially accessing memory beyond the bounds of the newly allocated table. The fix moves the disksize read to occur after acquiring dev_lock and verifying device initialization, ensuring the value remains stable throughout the scan. Local privilege or access to sysfs zram device files is required to trigger this condition.

Affected products

  • Linux Linux Kernel Multiple versions (see stable backports)

Timeline

  • 2026-09-11: disclosed
  • 2026-08-24: patched: Upstream patch committed by Andrew Morton
  • 2026-09-07: patched: Backport to stable trees by Greg Kroah-Hartman

References

Related threats